Director, Information Security

Loop•Chicago, IL

9d•$210,000 - $235,000•Onsite

About The Position

The Director of Information Security is a senior technical and operational leader who reports to Loop’s CISO. This builder role translates the company’s security strategy into a high-performing security program spanning security architecture, operations, incident response, vulnerability management, cloud and application security, identity and access, data protection, and technical controls. The Director works closely with Engineering, Product, IT, Legal, and business teams to identify risks, design practical controls, and ensure they work in practice. The role supports a company operating across enterprise software, AI, data, and payments, balancing the rigor expected in financial infrastructure with the speed and judgment of a high-growth software company. The position is in person in San Francisco, Chicago, or New York City, with office attendance four or more days per week. The Director partners with the CISO to develop a technical roadmap and operating plan, leads execution across core security domains, and establishes measurable objectives, metrics, and risk-remediation processes. They work with Engineering and Infrastructure to embed security into architecture and the software development lifecycle; design controls across cloud infrastructure, applications, APIs, endpoints, identity, data, and third-party integrations; and oversee threat modeling, architecture reviews, penetration testing, and technical risk assessments. The role also develops security architecture and guardrails for AI systems, agents, and emerging technologies. The Director builds and operates monitoring, detection, investigation, containment, remediation, vulnerability-management, and incident-response capabilities. They lead technical incident response, coordinate across relevant teams and executives, and ensure post-incident lessons lead to lasting improvements. They strengthen identity and access controls and protect sensitive customer, financial, employee, and company data through classification, encryption, retention, loss prevention, and monitoring controls. The role works with the CISO, Legal, and other stakeholders to translate security and privacy frameworks into effective technical controls; leads technical work for security assessments, audits, penetration tests, and remediation; supports enterprise customer security reviews; and assesses risks involving vendors, partners, acquisitions, and new technologies. The Director also helps shape and grow the security organization, recruits and develops security professionals, builds cross-functional relationships, and advances a security culture through automation, strong tooling, and clear ownership. The base salary range is $210,000–$235,000 annually. The role may also be eligible for an annual performance bonus and equity.

Requirements

At least 10 years of experience in information security, cybersecurity, security engineering, or related disciplines, with meaningful leadership experience.
Deep technical expertise across several security domains, such as cloud security, application security, security operations, identity, infrastructure security, incident response, or vulnerability management.
Experience operating security programs in a modern cloud-native technology environment.
Experience in fintech, payments, enterprise SaaS, AI/data infrastructure, or another environment handling sensitive or regulated data.
Strong understanding of AWS or comparable cloud environments, modern SaaS architectures, APIs, identity systems, and software development practices.
Experience building and operating detection, vulnerability-management, incident-response, and security-engineering capabilities.
Working knowledge of security and control frameworks such as SOC 2, NIST CSF, ISO 27001, NIST AI RMF, ISO 42001, GDPR, and related standards.
Ability to personally engage with technical details while leading teams and cross-functional programs.
Ability to communicate technical security risks clearly to engineers, executives, customers, and non-technical stakeholders.
Strong risk judgment, including the ability to distinguish urgent issues from risks that can be mitigated over time and to recognize when additional process adds little security value.
Builder mentality, with a preference for designing better systems and automating controls rather than administering manual processes.
High intellectual curiosity, particularly about the evolving security implications of AI and autonomous systems.

Responsibilities

Partner with the CISO to translate Loop’s security strategy into a technical roadmap and operating plan.
Own execution across security operations, vulnerability management, incident response, identity and access, data protection, security architecture, and third-party vendor risk management.
Bridge technical controls needed to meet compliance and audit requirements.
Partner with the CTO to integrate Product Security and DevSecOps.
Establish measurable security objectives, operating metrics, and processes for identifying and remediating risk.
Continuously improve Loop’s security posture as the company, product, and threat environment evolve.
Work with Engineering and Infrastructure to embed security into architecture and the software development lifecycle.
Design and implement controls across cloud infrastructure, applications, APIs, endpoints, identity, data, and third-party integrations.
Conduct and oversee threat modeling, architecture reviews, penetration testing, and technical risk assessments.
Help teams make security tradeoffs without unnecessarily slowing product development.
Develop security architecture for increasingly autonomous AI systems, agents, and workflows.
Build and operate monitoring, detection, investigation, containment, and remediation capabilities.
Own vulnerability management from discovery through prioritized remediation.
Develop and improve incident-response processes, tooling, playbooks, and exercises.
Lead technical response during security incidents and coordinate across Engineering, IT, Legal, Communications, and executive leadership.
Lead post-incident reviews and ensure lessons produce durable improvements.
Strengthen identity and access controls, including SSO, MFA, privileged access, RBAC, secrets management, and access lifecycle management.
Establish technical controls to protect sensitive customer, financial, employee, and company data.
Advance data classification, encryption, retention, loss prevention, and monitoring capabilities.
Develop practical security guardrails for generative AI, third-party models, agents, and emerging technologies.
Translate security and privacy frameworks into effective technical controls with the CISO, Legal, and other stakeholders.
Provide technical leadership for security assessments, audits, penetration tests, and remediation programs.
Support enterprise customer security reviews and engage with customer security teams when technical depth is needed.
Assess security risks associated with vendors, partners, acquisitions, and new technologies.
Ensure compliance requirements result in durable security improvements rather than check-the-box processes.
Help define the structure, capabilities, tooling, and talent needed as the security organization scales.
Recruit, develop, and lead security professionals.
Build strong working relationships across Engineering, Product, IT, Legal, Finance, and Operations.
Create leverage through automation, strong tooling, and clear ownership instead of relying on manual processes.
Develop a culture where security is a shared engineering and business responsibility.